botversion-sdk 2.2.2 → 2.3.0

package/undo/lib/undo-pg.js

@@ -0,0 +1,248 @@
+// lib/undo-pg.js
+"use strict";
+// UNDO (pg + Postgres): restores the rows saved for one AI action, all or nothing.
+// Uses the host's own connection pool (remembered by the pg hook). Logs: counts only.
+
+const log = require("./log");
+const snapshotCrypto = require("./snapshot-crypto");
+const { TABLE } = require("./snapshot-store");
+const requester = require("./requester");
+const guard = require("./capture-guard");
+const { Refuse } = require("./undo-prisma");
+
+let pool = null; // the host's own pg Pool
+function remember(p) {
+  if (p && typeof p.connect === "function") pool = p;
+}
+
+const q = (s) => '"' + String(s).replace(/"/g, '""') + '"';
+const tableSql = (label) => String(label).split(".").map(q).join(".");
+
+// Same text for equal rows: sorted keys, dates as ISO text, big numbers as text.
+function canon(v) {
+  return JSON.stringify(v, (k, val) => {
+    if (typeof val === "bigint") return val.toString();
+    if (val && typeof val === "object" && !Array.isArray(val)) {
+      const o = {};
+      for (const key of Object.keys(val).sort()) o[key] = val[key];
+      return o;
+    }
+    return val;
+  });
+}
+
+async function undoAction(actionId, requesterHash, opts) {
+  if (!pool || pool.ended || pool.ending) {
+    throw new Refuse(
+      "no-client",
+      "Undo is not ready yet: the app has not used its database in this process. Open any page of the app and try again.",
+    );
+  }
+  if (!snapshotCrypto.hasKey())
+    throw new Refuse("no-key", "Undo is off: no API key was given to the SDK.");
+
+  // Our own queries must never be captured again.
+  return guard.runUnhooked(async () => {
+    let client;
+    try {
+      client = await pool.connect();
+    } catch (_) {
+      throw new Refuse(
+        "no-client",
+        "Undo could not get a database connection. Nothing was changed.",
+      );
+    }
+
+    try {
+      await client.query("BEGIN");
+      // Order by real save time first: seq restarts for each request, so it cannot order rows across requests.
+      const res = await client.query(
+        `SELECT id, seq, table_name, operation, primary_key, before_data, after_data, requester_hash, status, (expires_at > now()) AS live ` +
+          `FROM ${TABLE} WHERE action_id = $1 ORDER BY created_at DESC, seq DESC FOR UPDATE`,
+        [actionId],
+      );
+      // Visual runs undo only the rows of one request (onlyIds); otherwise the whole action.
+      const only =
+        opts && opts.onlyIds
+          ? new Set(opts.onlyIds.map((x) => String(x).toLowerCase()))
+          : null;
+      const rows = only
+        ? res.rows.filter((r) => only.has(String(r.id).toLowerCase()))
+        : res.rows;
+      if (!rows.length)
+        throw new Refuse(
+          "not-found",
+          "Nothing to undo for this action (it may have expired or saved nothing).",
+        );
+      if (!rows.every((r) => requester.same(r.requester_hash, requesterHash))) {
+        throw new Refuse(
+          "forbidden",
+          "Undo refused: this request is not from the browser session that ran the AI action.",
+        );
+      }
+      if (rows.some((r) => r.status === "undone"))
+        throw new Refuse("already-undone", "This action was already undone.");
+      if (rows.some((r) => !r.live))
+        throw new Refuse(
+          "expired",
+          "Undo is no longer available: the 30 minute window has passed.",
+        );
+
+      for (const r of rows) {
+        // last write first; each write is checked just before it is reversed
+        if (!["insert", "update", "delete"].includes(r.operation))
+          throw new Refuse(
+            "unsupported",
+            "This kind of change cannot be undone yet. Nothing was changed.",
+          );
+        // A deleted row: put it back, but only if nothing else has taken its key since.
+        if (r.operation === "delete") {
+          if (!r.before_data)
+            throw new Refuse(
+              "conflict",
+              "The deleted row was not saved. Nothing was changed.",
+            );
+          const dpk = snapshotCrypto.decrypt(r.primary_key);
+          const old = snapshotCrypto.decrypt(r.before_data);
+          const dCols = Object.keys(dpk);
+          const dt = tableSql(r.table_name);
+          const dWhere = dCols
+            .map((c, i) => `${q(c)} = $${i + 1}`)
+            .join(" AND ");
+          const there = await client.query(
+            `SELECT 1 FROM ${dt} WHERE ${dWhere}`,
+            dCols.map((c) => dpk[c]),
+          );
+          if (there.rows.length)
+            throw new Refuse(
+              "conflict",
+              `Not undone: a row with the same key exists again in "${r.table_name}". Nothing was changed.`,
+            );
+          const cols = Object.keys(old);
+          await client.query(
+            `INSERT INTO ${dt} (${cols.map(q).join(", ")}) VALUES (${cols.map((c, i) => "$" + (i + 1)).join(", ")})`,
+            cols.map((c) => old[c]),
+          );
+          continue;
+        }
+
+        if (!r.after_data)
+          throw new Refuse(
+            "conflict",
+            `Cannot verify "${r.table_name}": its after-state was not saved. Nothing was changed.`,
+          );
+
+        const pk = snapshotCrypto.decrypt(r.primary_key);
+        const after = snapshotCrypto.decrypt(r.after_data);
+        const pkCols = Object.keys(pk);
+        const t = tableSql(r.table_name);
+        const where = pkCols.map((c, i) => `${q(c)} = $${i + 1}`).join(" AND ");
+        const pkVals = pkCols.map((c) => pk[c]);
+
+        const cur = await client.query(
+          `SELECT * FROM ${t} WHERE ${where}`,
+          pkVals,
+        );
+        if (cur.rows.length !== 1 || canon(cur.rows[0]) !== canon(after)) {
+          throw new Refuse(
+            "conflict",
+            `Not undone: a row in "${r.table_name}" was changed after the AI action. Nothing was changed.`,
+          );
+        }
+
+        if (r.operation === "insert") {
+          const del = await client.query(
+            `DELETE FROM ${t} WHERE ${where}`,
+            pkVals,
+          );
+          if (del.rowCount !== 1) throw new Error("unexpected delete count");
+        } else {
+          if (!r.before_data)
+            throw new Refuse(
+              "conflict",
+              "The old row was not saved. Nothing was changed.",
+            );
+          const before = snapshotCrypto.decrypt(r.before_data);
+          const cols = Object.keys(before).filter((c) => !pkCols.includes(c));
+          if (!cols.length) continue; // nothing besides the key to restore
+          const set = cols.map((c, i) => `${q(c)} = $${i + 1}`).join(", ");
+          const whereUp = pkCols
+            .map((c, i) => `${q(c)} = $${cols.length + i + 1}`)
+            .join(" AND ");
+          const up = await client.query(
+            `UPDATE ${t} SET ${set} WHERE ${whereUp}`,
+            [...cols.map((c) => before[c]), ...pkVals],
+          );
+          if (up.rowCount !== 1) throw new Error("unexpected update count");
+        }
+      }
+
+      // discard = rolled back by the confirm gate: remove the rows so the action can run again with the same id
+      if (opts && opts.discard && only)
+        await client.query(`DELETE FROM ${TABLE} WHERE id = ANY($1::uuid[])`, [
+          rows.map((r) => r.id),
+        ]);
+      else
+        await client.query(
+          opts && opts.discard
+            ? `DELETE FROM ${TABLE} WHERE action_id = $1`
+            : `UPDATE ${TABLE} SET status = 'undone' WHERE action_id = $1`,
+          [actionId],
+        );
+      await client.query("COMMIT");
+      return {
+        undone: rows.length,
+        hadDelete: rows.some((r) => r.operation === "delete"),
+      };
+    } catch (e) {
+      try {
+        await client.query("ROLLBACK");
+      } catch (_) {
+        /* ignore */
+      }
+      if (e instanceof Refuse && e.code === "conflict") {
+        try {
+          await client.query(
+            `UPDATE ${TABLE} SET status = 'conflict' WHERE action_id = $1`,
+            [actionId],
+          );
+        } catch (_) {
+          /* ignore */
+        }
+      }
+      throw e;
+    } finally {
+      try {
+        client.release();
+      } catch (_) {
+        /* ignore */
+      }
+    }
+  });
+}
+
+// Is there anything to undo for this action, for this browser session? Answers true/false only.
+// Throws Refuse("no-client") when the app has not used its pg pool yet.
+async function statusAction(actionId, requesterHash) {
+  if (!pool || pool.ended || pool.ending) {
+    throw new Refuse("no-client", "pg pool not ready.");
+  }
+  const res = await guard.runUnhooked(() =>
+    pool.query(
+      `SELECT requester_hash, status, (expires_at > now()) AS live FROM ${TABLE} WHERE action_id = $1`,
+      [actionId],
+    ),
+  );
+  const rows = res.rows;
+  return (
+    rows.length > 0 &&
+    rows.every(
+      (r) =>
+        requester.same(r.requester_hash, requesterHash) &&
+        r.status === "captured" &&
+        r.live === true,
+    )
+  );
+}
+
+module.exports = { remember, undoAction, statusAction };

package/undo/lib/undo-prisma-mongo.js

@@ -0,0 +1,263 @@
+// lib/undo-prisma-mongo.js
+"use strict";
+// UNDO (Prisma + MongoDB): restores the rows saved for one AI action.
+// MongoDB has no transaction around these commands, so Undo checks EVERY row first and only then restores:
+// if any row was changed after the AI action, nothing is touched. Logs: counts only.
+
+const log = require("./log");
+const snapshotCrypto = require("./snapshot-crypto");
+const store = require("./snapshot-store");
+const ms = require("./snapshot-store-prisma-mongo");
+const requester = require("./requester");
+const up = require("./undo-prisma");
+
+const { Refuse } = up;
+const num = ms.num;
+
+let base = null; // the app's own PrismaClient (not the extended one, so our writes are never captured)
+function remember(client) {
+  base = client;
+}
+
+const live = (r) => num(r.expires_at_ms) > Date.now();
+
+async function setStatus(actionId, from, to) {
+  await ms.cmd(base, {
+    update: store.TABLE,
+    updates: [
+      {
+        q: { action_id: actionId, status: from },
+        u: { $set: { status: to } },
+        multi: true,
+      },
+    ],
+  });
+}
+
+// Row (saved by column name) -> data for Prisma, by field name.
+function dataFrom(info, row, skipPk) {
+  const data = {};
+  for (const f of info.scalars) {
+    if (skipPk && info.pkFields.includes(f.name)) continue;
+    if (!(up.colOf(f) in row)) continue;
+    const v = row[up.colOf(f)];
+    if (v === null && f.type === "Json") {
+      const n = up.jsonNull();
+      if (n) data[f.name] = n;
+      continue;
+    }
+    data[f.name] = v;
+  }
+  return data;
+}
+
+async function undoAction(actionId, requesterHash, opts) {
+  if (!base || typeof base.$runCommandRaw !== "function") {
+    throw new Refuse(
+      "no-client",
+      "Undo is not ready yet: the app has not created its Prisma client in this process. Open any page of the app and try again.",
+    );
+  }
+  if (!snapshotCrypto.hasKey())
+    throw new Refuse("no-key", "Undo is off: no API key was given to the SDK.");
+
+  let claimed = false;
+  try {
+    let rows = await ms.findByAction(base, actionId);
+    // Visual runs undo only the rows of one request (onlyIds); otherwise the whole action.
+    const onlyIds = opts && opts.onlyIds ? opts.onlyIds : null;
+    if (onlyIds) {
+      const s = new Set(onlyIds);
+      rows = rows.filter((r) => s.has(r._id));
+    }
+    if (!rows.length)
+      throw new Refuse(
+        "not-found",
+        "Nothing to undo for this action (it may have expired or saved nothing).",
+      );
+    if (!rows.every((r) => requester.same(r.requester_hash, requesterHash)))
+      throw new Refuse(
+        "forbidden",
+        "Undo refused: this request is not from the browser session that ran the AI action.",
+      );
+    if (rows.some((r) => r.status === "undone" || r.status === "undoing"))
+      throw new Refuse(
+        "already-undone",
+        "This action was already undone (or is being undone right now).",
+      );
+    if (rows.some((r) => !live(r)))
+      throw new Refuse(
+        "expired",
+        "Undo is no longer available: the 30 minute window has passed.",
+      );
+    // Order by real save time first: seq restarts for each request, so it cannot order rows across requests.
+    rows.sort(
+      (a, b) =>
+        num(b.created_at_ms) - num(a.created_at_ms) || num(b.seq) - num(a.seq),
+    ); // last write first
+
+    // 1. Group the saved rows by document (newest first inside each group).
+    const groups = new Map();
+    for (const r of rows) {
+      if (!["insert", "update", "delete"].includes(r.operation))
+        throw new Refuse(
+          "unsupported",
+          "This kind of change cannot be undone yet. Nothing was changed.",
+        );
+      const info = up.infoFor(r.table_name);
+      if (!info)
+        throw new Refuse(
+          "unsupported",
+          `Cannot undo changes to "${r.table_name}" yet (only Prisma models are supported for now). Nothing was changed.`,
+        );
+      const before =
+        r.before_data == null ? null : snapshotCrypto.decrypt(r.before_data);
+      const after =
+        r.operation === "delete" || r.after_data == null
+          ? null
+          : snapshotCrypto.decrypt(r.after_data);
+      if (r.operation !== "delete" && after === null)
+        throw new Refuse(
+          "conflict",
+          `Cannot verify "${r.table_name}": its after-state was not saved. Nothing was changed.`,
+        );
+      if (r.operation !== "insert" && before === null)
+        throw new Refuse(
+          "conflict",
+          "The old row was not saved. Nothing was changed.",
+        );
+      const pk = snapshotCrypto.decrypt(r.primary_key);
+      const key = r.table_name + "\u0002" + up.canon(pk);
+      if (!groups.has(key)) groups.set(key, []);
+      groups.get(key).push({ r, info, pk, before, after });
+    }
+
+    // 2. Check EVERY row before touching any.
+    for (const items of groups.values()) {
+      const top = items[0];
+      const cur = await base[top.info.acc].findFirst({
+        where: up.whereOf(top.info, top.pk),
+      });
+      const curCols = cur ? up.toColumns(top.info, cur) : null;
+      let ok = up.canon(curCols) === up.canon(top.after);
+      // Several writes to the same row must follow each other without a gap.
+      for (let i = 1; ok && i < items.length; i++)
+        ok = up.canon(items[i - 1].before) === up.canon(items[i].after);
+      if (!ok)
+        throw new Refuse(
+          "conflict",
+          `Not undone: a row in "${top.r.table_name}" was changed after the AI action. Nothing was changed.`,
+        );
+    }
+
+    // 3. Claim the rows, so two Undo clicks at the same moment cannot both run.
+    const claim = await ms.cmd(base, {
+      update: store.TABLE,
+      updates: [
+        {
+          q: Object.assign(
+            { action_id: actionId, status: { $in: ["captured", "conflict"] } },
+            onlyIds ? { _id: { $in: onlyIds } } : {},
+          ),
+          u: { $set: { status: "undoing" } },
+          multi: true,
+        },
+      ],
+    });
+    const claimedCount = num(claim.nModified);
+    claimed = claimedCount > 0;
+    if (claimedCount !== rows.length)
+      throw new Refuse(
+        "already-undone",
+        "This action was already undone (or is being undone right now).",
+      );
+
+    // 4. Restore: each row goes back to how it looked before the FIRST write of this action.
+    try {
+      for (const items of groups.values()) {
+        const first = items[items.length - 1];
+        const delegate = base[first.info.acc];
+        const where = up.whereOf(first.info, first.pk);
+        const cur = await delegate.findFirst({ where });
+        if (first.before === null) {
+          if (cur) await delegate.deleteMany({ where });
+        } else if (cur) {
+          const data = dataFrom(first.info, first.before, true);
+          if (Object.keys(data).length)
+            await delegate.updateMany({ where, data });
+        } else {
+          await delegate.create({
+            data: dataFrom(first.info, first.before, false),
+          });
+        }
+      }
+    } catch (e) {
+      throw new Refuse(
+        "partial",
+        "Undo stopped part-way because of a database error. Some rows may be restored and the rest are not.",
+      );
+    }
+
+    // discard = rolled back by the confirm gate: remove the rows so the action can run again with the same id
+    if (opts && opts.discard)
+      await ms.cmd(base, {
+        delete: store.TABLE,
+        deletes: [
+          {
+            q: onlyIds
+              ? { _id: { $in: rows.map((r) => r._id) } }
+              : { action_id: actionId },
+            limit: 0,
+          },
+        ],
+      });
+    else
+      await ms.cmd(base, {
+        update: store.TABLE,
+        updates: [
+          {
+            q: { action_id: actionId },
+            u: { $set: { status: "undone" } },
+            multi: true,
+          },
+        ],
+      });
+    claimed = false;
+    return {
+      undone: rows.length,
+      hadDelete: rows.some((r) => r.operation === "delete"),
+    };
+  } catch (e) {
+    try {
+      if (claimed)
+        await setStatus(
+          actionId,
+          "undoing",
+          e instanceof Refuse && e.code !== "partial" ? "captured" : "conflict",
+        );
+      else if (e instanceof Refuse && e.code === "conflict")
+        await setStatus(actionId, "captured", "conflict");
+    } catch (_) {
+      /* ignore */
+    }
+    throw e;
+  }
+}
+
+// Is there anything to undo for this action, for this browser session? Answers true/false only.
+async function statusAction(actionId, requesterHash) {
+  if (!base || typeof base.$runCommandRaw !== "function")
+    throw new Refuse("no-client", "Prisma client not ready.");
+  const rows = await ms.findByAction(base, actionId);
+  return (
+    rows.length > 0 &&
+    rows.every(
+      (r) =>
+        requester.same(r.requester_hash, requesterHash) &&
+        r.status === "captured" &&
+        live(r),
+    )
+  );
+}
+
+module.exports = { remember, undoAction, statusAction };